Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240708-en
windows7-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20241010-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240708-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral6
Sample
3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral7
Sample
4.exe
Resource
win7-20241010-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral8
Sample
4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
General
-
Target
2.exe
-
Size
2.5MB
-
MD5
b4448ceddd85ec0f061f53ab1a977b5e
-
SHA1
96c63c3c423e4b1117e0c82e5796dcd5f1c0d683
-
SHA256
d7c50dce5f77ae0f144843e8eaf3e29034e14f6ac9293f0dbdf59fd2fc257452
-
SHA512
29f1c8f4d1e551e31d453c455bddb1e9fe8d74bca35338757ab9d3b31110c460b69ed06d5b452376b57afa4a82f5d4b2cdab7dfa8e636cb800d0a3fcded4b1f3
-
SSDEEP
49152:QgwR+ifu1DBgutBPN2q1dNnzbpz7Mwulf+qV8L77hpe3D04dtaa7P:QgwR+vguPP/7NzRMwulF8L/hpe3YI
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt
Ransom Note
Greetings,
There was a serious security breach in your systems and this was detected during our scans.
We encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files,
process and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data.
If you wish, you can contact us via the following communication to resolve this issue.
YOUR REFERENCE CODE
IR4beVNncsM8-Z9mwBnn79YzSumzz2csRQ_Nn7Z80ns*[email protected]
[email protected]
[email protected]
Emails
Signatures
-
Detects Mimic ransomware 2 IoCs
resource yara_rule behavioral4/files/0x0007000000023cbd-39.dat family_mimic behavioral4/files/0x0007000000023cbc-49.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 376 bcdedit.exe 1608 bcdedit.exe -
Renames multiple (3735) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3812 wbadmin.exe -
pid Process 4264 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe BLUE.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 2.exe -
Executes dropped EXE 13 IoCs
pid Process 4908 7za.exe 3120 7za.exe 448 TEQ2.exe 1952 BLUE.exe 2652 DC.exe 3788 BLUE.exe 2160 BLUE.exe 2172 BLUE.exe 216 Everything.exe 1864 Everything.exe 3184 xdel.exe 2576 xdel.exe 4064 xdel.exe -
Loads dropped DLL 5 IoCs
pid Process 448 TEQ2.exe 1952 BLUE.exe 2160 BLUE.exe 3788 BLUE.exe 2172 BLUE.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command TEQ2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLUE = "\"C:\\Users\\Admin\\AppData\\Local\\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\\BLUE.exe\" " TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLUE.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\IMPORTANT_NOTICE.txt\"" BLUE.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\O: BLUE.exe File opened (read-only) \??\Q: BLUE.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\S: BLUE.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\A: BLUE.exe File opened (read-only) \??\L: BLUE.exe File opened (read-only) \??\Z: BLUE.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\Y: BLUE.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\W: BLUE.exe File opened (read-only) \??\R: BLUE.exe File opened (read-only) \??\V: BLUE.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\E: BLUE.exe File opened (read-only) \??\G: BLUE.exe File opened (read-only) \??\I: BLUE.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\H: BLUE.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\K: BLUE.exe File opened (read-only) \??\T: BLUE.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\J: BLUE.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\M: BLUE.exe File opened (read-only) \??\N: BLUE.exe File opened (read-only) \??\P: BLUE.exe File opened (read-only) \??\U: BLUE.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\A: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1152 powercfg.exe 4716 powercfg.exe 8 powercfg.exe 2236 powercfg.exe 3888 powercfg.exe 3492 powercfg.exe 1080 powercfg.exe 2328 powercfg.exe 2652 powercfg.exe 4328 powercfg.exe 3428 powercfg.exe 4072 powercfg.exe 2032 powercfg.exe 2392 powercfg.exe 4788 powercfg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Java\jdk-1.8\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 [email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\[email protected] BLUE.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\[email protected] BLUE.exe File opened for modification C:\Program Files\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\[email protected] BLUE.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 1020 powershell.exe 4392 powershell.exe 5072 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEQ2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\IMPORTANT_NOTICE.txt\"" BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\.blue BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.blue\ = "mimicfile" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open TEQ2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell TEQ2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command BLUE.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4300 notepad.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2160 BLUE.exe 2160 BLUE.exe 2172 BLUE.exe 2172 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1020 powershell.exe 1020 powershell.exe 4392 powershell.exe 4392 powershell.exe 5072 powershell.exe 5072 powershell.exe 1020 powershell.exe 4392 powershell.exe 5072 powershell.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe 1952 BLUE.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4908 7za.exe Token: 35 4908 7za.exe Token: SeRestorePrivilege 3120 7za.exe Token: 35 3120 7za.exe Token: SeSecurityPrivilege 3120 7za.exe Token: SeSecurityPrivilege 3120 7za.exe Token: SeIncreaseQuotaPrivilege 448 TEQ2.exe Token: SeSecurityPrivilege 448 TEQ2.exe Token: SeTakeOwnershipPrivilege 448 TEQ2.exe Token: SeLoadDriverPrivilege 448 TEQ2.exe Token: SeSystemProfilePrivilege 448 TEQ2.exe Token: SeSystemtimePrivilege 448 TEQ2.exe Token: SeProfSingleProcessPrivilege 448 TEQ2.exe Token: SeIncBasePriorityPrivilege 448 TEQ2.exe Token: SeCreatePagefilePrivilege 448 TEQ2.exe Token: SeBackupPrivilege 448 TEQ2.exe Token: SeRestorePrivilege 448 TEQ2.exe Token: SeShutdownPrivilege 448 TEQ2.exe Token: SeDebugPrivilege 448 TEQ2.exe Token: SeSystemEnvironmentPrivilege 448 TEQ2.exe Token: SeChangeNotifyPrivilege 448 TEQ2.exe Token: SeRemoteShutdownPrivilege 448 TEQ2.exe Token: SeUndockPrivilege 448 TEQ2.exe Token: SeManageVolumePrivilege 448 TEQ2.exe Token: SeImpersonatePrivilege 448 TEQ2.exe Token: SeCreateGlobalPrivilege 448 TEQ2.exe Token: 33 448 TEQ2.exe Token: 34 448 TEQ2.exe Token: 35 448 TEQ2.exe Token: 36 448 TEQ2.exe Token: SeIncreaseQuotaPrivilege 1952 BLUE.exe Token: SeSecurityPrivilege 1952 BLUE.exe Token: SeTakeOwnershipPrivilege 1952 BLUE.exe Token: SeLoadDriverPrivilege 1952 BLUE.exe Token: SeSystemProfilePrivilege 1952 BLUE.exe Token: SeSystemtimePrivilege 1952 BLUE.exe Token: SeProfSingleProcessPrivilege 1952 BLUE.exe Token: SeIncBasePriorityPrivilege 1952 BLUE.exe Token: SeCreatePagefilePrivilege 1952 BLUE.exe Token: SeBackupPrivilege 1952 BLUE.exe Token: SeRestorePrivilege 1952 BLUE.exe Token: SeShutdownPrivilege 1952 BLUE.exe Token: SeDebugPrivilege 1952 BLUE.exe Token: SeSystemEnvironmentPrivilege 1952 BLUE.exe Token: SeChangeNotifyPrivilege 1952 BLUE.exe Token: SeRemoteShutdownPrivilege 1952 BLUE.exe Token: SeUndockPrivilege 1952 BLUE.exe Token: SeManageVolumePrivilege 1952 BLUE.exe Token: SeImpersonatePrivilege 1952 BLUE.exe Token: SeCreateGlobalPrivilege 1952 BLUE.exe Token: 33 1952 BLUE.exe Token: 34 1952 BLUE.exe Token: 35 1952 BLUE.exe Token: 36 1952 BLUE.exe Token: SeIncreaseQuotaPrivilege 3788 BLUE.exe Token: SeSecurityPrivilege 3788 BLUE.exe Token: SeTakeOwnershipPrivilege 3788 BLUE.exe Token: SeLoadDriverPrivilege 3788 BLUE.exe Token: SeSystemProfilePrivilege 3788 BLUE.exe Token: SeIncreaseQuotaPrivilege 2160 BLUE.exe Token: SeSystemtimePrivilege 3788 BLUE.exe Token: SeSecurityPrivilege 2160 BLUE.exe Token: SeProfSingleProcessPrivilege 3788 BLUE.exe Token: SeTakeOwnershipPrivilege 2160 BLUE.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 216 Everything.exe 1864 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4908 4704 2.exe 85 PID 4704 wrote to memory of 4908 4704 2.exe 85 PID 4704 wrote to memory of 4908 4704 2.exe 85 PID 4704 wrote to memory of 3120 4704 2.exe 89 PID 4704 wrote to memory of 3120 4704 2.exe 89 PID 4704 wrote to memory of 3120 4704 2.exe 89 PID 4704 wrote to memory of 448 4704 2.exe 91 PID 4704 wrote to memory of 448 4704 2.exe 91 PID 4704 wrote to memory of 448 4704 2.exe 91 PID 448 wrote to memory of 1952 448 TEQ2.exe 94 PID 448 wrote to memory of 1952 448 TEQ2.exe 94 PID 448 wrote to memory of 1952 448 TEQ2.exe 94 PID 1952 wrote to memory of 1428 1952 BLUE.exe 96 PID 1952 wrote to memory of 1428 1952 BLUE.exe 96 PID 1952 wrote to memory of 1428 1952 BLUE.exe 96 PID 1428 wrote to memory of 2652 1428 cmd.exe 99 PID 1428 wrote to memory of 2652 1428 cmd.exe 99 PID 1428 wrote to memory of 2652 1428 cmd.exe 99 PID 1952 wrote to memory of 3788 1952 BLUE.exe 100 PID 1952 wrote to memory of 3788 1952 BLUE.exe 100 PID 1952 wrote to memory of 3788 1952 BLUE.exe 100 PID 1952 wrote to memory of 2160 1952 BLUE.exe 101 PID 1952 wrote to memory of 2160 1952 BLUE.exe 101 PID 1952 wrote to memory of 2160 1952 BLUE.exe 101 PID 1952 wrote to memory of 2172 1952 BLUE.exe 102 PID 1952 wrote to memory of 2172 1952 BLUE.exe 102 PID 1952 wrote to memory of 2172 1952 BLUE.exe 102 PID 1952 wrote to memory of 216 1952 BLUE.exe 106 PID 1952 wrote to memory of 216 1952 BLUE.exe 106 PID 1952 wrote to memory of 216 1952 BLUE.exe 106 PID 4704 wrote to memory of 4316 4704 2.exe 107 PID 4704 wrote to memory of 4316 4704 2.exe 107 PID 4704 wrote to memory of 4316 4704 2.exe 107 PID 1952 wrote to memory of 1152 1952 BLUE.exe 123 PID 1952 wrote to memory of 1152 1952 BLUE.exe 123 PID 1952 wrote to memory of 4072 1952 BLUE.exe 124 PID 1952 wrote to memory of 4072 1952 BLUE.exe 124 PID 1952 wrote to memory of 2032 1952 BLUE.exe 127 PID 1952 wrote to memory of 2032 1952 BLUE.exe 127 PID 1952 wrote to memory of 1080 1952 BLUE.exe 128 PID 1952 wrote to memory of 1080 1952 BLUE.exe 128 PID 1952 wrote to memory of 3492 1952 BLUE.exe 129 PID 1952 wrote to memory of 3492 1952 BLUE.exe 129 PID 1952 wrote to memory of 3428 1952 BLUE.exe 131 PID 1952 wrote to memory of 3428 1952 BLUE.exe 131 PID 1952 wrote to memory of 4716 1952 BLUE.exe 132 PID 1952 wrote to memory of 4716 1952 BLUE.exe 132 PID 1952 wrote to memory of 4788 1952 BLUE.exe 133 PID 1952 wrote to memory of 4788 1952 BLUE.exe 133 PID 1952 wrote to memory of 2392 1952 BLUE.exe 135 PID 1952 wrote to memory of 2392 1952 BLUE.exe 135 PID 1952 wrote to memory of 3888 1952 BLUE.exe 136 PID 1952 wrote to memory of 3888 1952 BLUE.exe 136 PID 1952 wrote to memory of 2236 1952 BLUE.exe 137 PID 1952 wrote to memory of 2236 1952 BLUE.exe 137 PID 1952 wrote to memory of 4328 1952 BLUE.exe 139 PID 1952 wrote to memory of 4328 1952 BLUE.exe 139 PID 1952 wrote to memory of 2652 1952 BLUE.exe 141 PID 1952 wrote to memory of 2652 1952 BLUE.exe 141 PID 1952 wrote to memory of 8 1952 BLUE.exe 143 PID 1952 wrote to memory of 8 1952 BLUE.exe 143 PID 1952 wrote to memory of 2328 1952 BLUE.exe 144 PID 1952 wrote to memory of 2328 1952 BLUE.exe 144 PID 1952 wrote to memory of 1020 1952 BLUE.exe 146 -
System policy modification 1 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Greetings,\nThere was a serious security breach in your systems and this was detected during our scans.\nWe encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files,\nprocess and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data.\n\nIf you wish, you can contact us via the following communication to resolve this issue.\n\nYOUR REFERENCE CODE\n\nIR4beVNncsM8-Z9mwBnn79YzSumzz2csRQ_Nn7Z80ns*[email protected]\n\n\[email protected]\[email protected]" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" BLUE.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p3168920970217226645 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"3⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\DC.exeDC.exe /D5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652
-
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e watch -pid 1952 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:216
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:1152
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4072
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2032
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1080
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:3492
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:3428
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:4716
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4788
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2392
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3888
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2236
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:4328
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2652
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:8
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:2328
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:376
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1608
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3812
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:4264
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt"4⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:4300
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe" -accepteula -p 1 -c C:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3184
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe" -accepteula -p 1 -c F:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\xdel.exe" -accepteula -p 1 -c Z:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4064
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:4316
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5000
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4880
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4664
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4980
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4772
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3200
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1644
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5056
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4480
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2028
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:4924
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1316
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3412
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3500
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4116
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798B
MD5c7a8079febd7b8a6040d217d659a4b09
SHA1a602c223f63553795c24f8cc5d8722acc338a6a4
SHA256d7606476e2d903b662a9011fc7488466a6dac6433a04643f1e02a3827a25fea8
SHA5125b33ffb02ec2bb9e52ea4a1090a281e941b72b88138425007549149e220525fc75af9a57ee3d5e36e1af7a1d6c392f0869a98cb99c1fa45a1c7511ef0df4bb16
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
1KB
MD58a88ad1830606a82af357c8075589eda
SHA11a18f647692506c3e48f674c84d39a5c87e12b98
SHA256c83a52c7e4701677fd27d2645ea43c783c09b1b776bc87ed83d23394ecedaa53
SHA5128743281df53e70974d18cc17542a38dda9b54e59caf7165c96a9352646e93bb4ff4882a49a9f23fffd5534bca0fc22b08bcd33fb0047df159a38d2bf3a7f2f2f
-
Filesize
174B
MD594d62832943fa8f282367ca15255a25b
SHA13ccbcde23a806b376cea982be7959f26c8c7785e
SHA2561f638f58006bdb99d8c02d55f19d72a90bd35a50b6cfe55055ec9a0ea400ac2c
SHA512c3d901d178051c87b74c7e75c74667f54b66290e76dc1b74cfb2b5646d6b65fa5edeea5569eb75aa1e246c56dd626b212fa9064c7fe538ca10b9100dc295df78
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.5MB
MD5fc8231d24af5721342e70a9c5bb770c4
SHA1a6fea2adbd6022e230755b259cbf3f09c942d01c
SHA25622cb66ff8946f7e353f1c23b2e17af95fc7a98f87a1ee941ec36b83b7880653e
SHA512d327552bab810596c9d54c1d0ac2e1bf446164fdff0f79cfdd48cfc455a9e86c88bc24aa2e43f890763332a3150bb939354e87d57ef81bd285159977e06ce3ef
-
Filesize
2.0MB
MD5b04b206674bab7a4229f34b6ac511903
SHA1064ab6347a40cba3bbe594f226baff3772212d61
SHA2562aafc4ee5edb0dd956cbdfbd9c11a23e2e61102986b6428e3e27eeb09e0fba74
SHA5123584df640cf090820fa818073b5299ad0d979eb87d920140697b550d29fa692cbc7d61742e61ce935347c5a3428db4f3ac8d4159c7053fafabf1051b5587420d
-
Filesize
2.1MB
MD57ca770cc5f649256a18623245348f39f
SHA181398374ba4751a61a0d9949cc1fe75f18960741
SHA25607631e96b95b1f01bdc591699ae6bc2e6787387cbe865bc11004bd34c0f9c3a4
SHA512bd70b65f1ef54f1eed3e48013c0332d82370caacd67304e20497c5c8f6d6fd5ef2d838ecc9c4e80dca4e4a107676942495cce4c2526281b32fcad2ee12b33cdc
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13.2MB
MD5db2e1bed8a216b1e65bcc995c7c46a2e
SHA18a123cf1447e70a3808038fcd7e10deb6ddb4e71
SHA256958a738f53b03f6b0957493857e63e339be9f9a0365acf3acc017be8cc6cee4b
SHA5127b3966b3a1db6e2d4c22f7cb293c1267698fc1a35ef463982d3cf1a822ff5fc012f662b7a06034268599eeb427d7fd29961761ecf9bc812eb27fb9bff09598e3
-
Filesize
20KB
MD5f5329556661026f4008bce69c9a20c1b
SHA1e66a0f986a07aefa08a1991227c82a82171267ff
SHA25651ac8d997a29d5fc60f71c2446225521a7ecf6edc142ae7c18e05f358f403994
SHA512848150bc531251d0cd09e48227a89812f7b36f59de42e01d0da30a438b16a561a5f8a05b354d19aea1fcae5664135f63fe7ab737212cf58fb510e89c1fd6fa33
-
Filesize
32B
MD57556b827fec4e78503af35eb10d26998
SHA1fd5fe00ccfb62c30a94114b4db7e40777192b719
SHA256ec487d5aafcb9f0cf75c5fc2440e308f9b6ae385f10cfc072e52c2e7f7f9314c
SHA512fdf3ded23bfb5f87bc0fdb2c8d5dc14118144fae59b24b03443d156ace9520abebffd0827cc7d2040edecd1f83812fcd8aa6cdaf2d0ae8f47c093e455beec14b
-
Filesize
6KB
MD563b9e5b06153f611d98df6b38a8fcb33
SHA15990afba29287f9037768c4af29698cfec8859fa
SHA25671afad21cd42adfff8738644a8fb7e72868fe591adac4c17194b8d63bbcbf3ef
SHA5122c5819b5b714c6771a5dc9b48349b22e6801bd53b7c222c1b188b8a02def80a0803d0b7968ca4af1cb59409f71f88b7e61a30013e19672a50582e30846c58bdc